BleepingComputer.com: My Win 98se hijacked!

Hi everyone,
Due to a system crasch(not because of this problem) and a complete operating system reinstall, I have been reinstalling all or most of all my disked applications. As the days have gone by I have been remembering some, hopefully all, the applications I have downloaded from the Web over the years. Well, I was downloading what I thought was a Winmx 2.6 setup. NOT! I ended up downloading Netwebsearch. Knowing that I had not installed Winmx, I deleted it from my ADD/Remove Programs as well as anything in the File Find under the name it was hidden in(winmx....). After doing this, I noticed I was getting a blank window who's name is netwebsearch. Well I was able to set my pop-up blocker to handle it's constant intrusion. I also noticed at times I was not able to close or open IE without using Control/Alt./DEl first. When I did this there was 2-3 IE's open at one time. I believe I've been hijacked! This is a first for me. I'd like to get my hands on this person. Anyway, I ran Spybot, Ad-aware, Norton Virus Scan, Micro Trend's House Call(from their website. There were a few things but everytime I opened IE it would still have a flash of this netwebsearch window before my pop-up blocker would close the window. My pop-up blocker which came with HISTORY KILL2003 has now been disabled. Probably due to netwebsearch. I'm going to have to reinstall History Kill after I can hopefully remove netwebsearch. It also wouldn't let me seasrch for any info on how to remove this piece of s--t!

After what happened with my hard drive crash a week ago, I'm pretty mad.
Please, Please help!
I need some help figuring out what to do.

I have moved this to the more appropriate Forum. ~Scarlett

This post has been edited by codajohn: 06 January 2005 - 10:13 PM

Download the latest version of HijackThis (HJT), from here.

Put HijackThis in a Permanent folder:
Click My Computer / C: / File / New / Folder / name the folder; HijackThis
Put HijackThis.exe, in this folder.
This is a mandatory step, for the backup and restore functions, of HijackThis, to be able to work.

Read the pinned post in the HJT forum, here

Then, run a log, and post it in the HJT forum, at this link. Do not, fix anything, yet.
A member, of the HJT Team, will help you out.
Please, be patient, these people are volunteers. They will help you out, as soon as possible.

That way we can eliminate the possibility of spyware/malware, being the cause of your
problem.

If this doesn't help with your problem, then post back in the appropriate forum. In your
post, mention that you have already submited a HJT log, and it was cleaned.
This way we can start looking for the problem on a clean machine.

tj1911
Thank you sooooooooooooo.....much! I have been reading the different posts. IS NETWEDSEARCH A HIJACKER? This forum site is GREAT. The only problem I have is that I lost my winzip application in my hijacked computer last week due to a hard drive crash. Is there any free decompression application I can download to take care of this? Thanks for your advice.
Codajohn

You're quite welcome.

Netwebsearch is an adware toolbar.
http://www.spywareguide.com/spydet_1281_netwebsearch.html

Here's a couple of sites with, free software, you can check for zip utilities:

Majorgeeks
Snapfiles

I didn't see a tool bar in the right had corner as per the site information. All the Adware and Spyware programs I am running did't seem to remove this garbage. any other Ideas? I'm also having problems opening OWA from the desktop.
Thanks.

Run a HijackThis log, as per the previous post, and post it in the HJT forum at this link.

Are you using these security programs, also?
a² free-a complementary product to antivirus software which is specialized in protection against harmful software. Antivirus software often features an inadequate protection against Trojans, Dialers and Spyware. a² fills this gap.
SpywareBlaster-A good program that prevents spyware from being installed on your computer in the first place. This program is always running in the background, protecting your computer. It prevents the installation of bad active X controls found in web pages.
SpywareGuard-A nice compliment to SpywareBlaster. This allows you the option to prevent downloads that contain bad active X controls.

If not, you need to. These programs, updated and used regularly, along with Ad-aware & Spybot, will do a lot to keep your computer clean of spyware, trojans, keyloggers, browser hijackers, etc...

Download them, update them, and then run them.

Hi tg1911,
I have posted a log on the now third page of logs under codajohn.
I run Adaware and Spybot. They didn't seem to find Netwebsearch when I ran a scan yesterday with both. I run these programs at least once a week. I have Norton System Works 2003. I have a yearly subscripton to udate everything in Norton. I have the auto start-up andupdate enabled. A2free sounds interesting. I try it when I get home from work. I tried to install sypwareguard last night as per suggestions. When I booted up this morning it mentioned one file was not installed properly. Is this because of antivirus program runnig during installation?
I also installed WINRAR on the computer last night. Found a copy on Shareaza about a week ago. I had it on my lapxp and burned a disk to install in on my desktop 98se. I decompressed the Hijackthis program first on my lap and then burned a copy of the data files onto disk. Is this program O.K.?
Thanks so much for your help and information.
You guys clearly are the best.
Speak to you soon,
Codajohn
P.S.
The link to the Netwebsearch removal info talkes about a tool bar deletion to remove this garbage. Is this toolbar in the Netwebsearch window or in the IE window? When shutting down IE, the window disappears but my desktop function is lost until I got into Alt/Crtl/Delete and find that IE is stll running. I have to end task and then my desktop fuction come back. Is this a part of Netwebsearch? Sorry for the long P.S.

This post has been edited by codajohn: 07 January 2005 - 12:57 PM

Quote

I also use Norton, not System Works, just the antivirus. Something I've noticed, and you might want to check this out, is that on their auto updates, you don't always get the full update. I've got in the habit of running Live Update once a week, just to make sure I'm fully updated. Several times, there were additional updates to be had. Just a heads-up.

Quote

I'm not sure if that was the cause, but it's a good idea to turn off your AV, and any other running programs, before you install a new program. Try uninstalling Spywareguard, and then reinstalling. See if that helps.

Quote

I don't use the program, but I have seen others that do. I haven't heard anything bad about it, and the ones that use it, seem to be happy with it.

Quote

I not familiar with the with the workings of all of the spyware/malware out there, but the HJT Team member that takes care of your log, should be able to give you more info on this.

I hope we can get all of your problems taken care of, and if you have any more questions, be sure to ask. If I can't help you, I'm sure one of our 7000+ members can.
When you have free time, be sure to check out our Tutorials. There's a lot of very good information to be had there.

Welcome to BC, and I hope you enjoy your stay.

tg1191,
Again, thank you very much for your assistance. I knew about the auto up-date. I always hit the live update button myself a few times a week.I look forward to heaing about my log.
Codajohn

This post has been edited by codajohn: 07 January 2005 - 12:55 PM